Advanced Post Manager
Monthly
Object injection in the WordPress plugin Advanced Post Manager (all releases through version 4.5.5) lets remote attackers push attacker-controlled serialized data into PHP's unserialize() routine, potentially instantiating arbitrary objects and, where a usable POP gadget chain exists, achieving code execution with full confidentiality, integrity and availability impact. The NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) treats the flaw as unauthenticated and network-reachable, whereas our independent assessment raises attack complexity to High because real-world impact hinges on a reachable gadget chain in the plugin, WordPress core or another active plugin; no public exploit identified at time of analysis and there is no CISA KEV entry for this CVE.
Object injection in the WordPress plugin Advanced Post Manager (all releases through version 4.5.5) lets remote attackers push attacker-controlled serialized data into PHP's unserialize() routine, potentially instantiating arbitrary objects and, where a usable POP gadget chain exists, achieving code execution with full confidentiality, integrity and availability impact. The NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) treats the flaw as unauthenticated and network-reachable, whereas our independent assessment raises attack complexity to High because real-world impact hinges on a reachable gadget chain in the plugin, WordPress core or another active plugin; no public exploit identified at time of analysis and there is no CISA KEV entry for this CVE.